What it means
Who and what it covers
PCI DSS concerns entities that store, process or transmit relevant card data, and entities that can affect the security of the cardholder data environment. The assessment scope depends on the actual payment design and responsibilities.
Assess evidence, not a badge
A merchant should identify the relevant service, responsibilities and validation evidence. Outsourcing a payment page can change scope but does not automatically remove every obligation. A crypto-only transfer and a checkout that also handles payment cards must be assessed according to their actual data flows.
Related concepts
In practice
A concrete example
A merchant maps where card data is entered and which systems can affect that environment before deciding which validation process applies.
Technical notes & boundaries
PCI DSS is not a blanket certification that a business is secure, and it is not a general blockchain security standard.
Go to the source.
Original references used for this definition. Product details and standards can change.
